CVE-2026-64056 (GCVE-0-2026-64056)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
net: ethernet: cortina: Make RX SKB per-port
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead. Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped. Zero it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 27856d533eca3804008695f61c1e4d5ff984196b (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < b6b22824b30e48ce1df3a2e80990f4b8505deb50 (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 6bba24e9ebe6f1c0b356cd471e36bdc7fa434897 (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 3b249988d774dacf13b203817e971934a42243c4 (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 72158ea185b27afae163949b0e86164cb6b64e55 (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < cfd62907f3cdbc3b6da8f49ba907c0390018fe5e (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 67a35e7da7ef9d2f000aa758552a128324c604a0 (git)
Affected: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 , < 06937db21ee311ed07eba47954447245041a982d (git)
Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cortina/gemini.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27856d533eca3804008695f61c1e4d5ff984196b",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "b6b22824b30e48ce1df3a2e80990f4b8505deb50",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "6bba24e9ebe6f1c0b356cd471e36bdc7fa434897",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "3b249988d774dacf13b203817e971934a42243c4",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "72158ea185b27afae163949b0e86164cb6b64e55",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "cfd62907f3cdbc3b6da8f49ba907c0390018fe5e",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "67a35e7da7ef9d2f000aa758552a128324c604a0",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "06937db21ee311ed07eba47954447245041a982d",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cortina/gemini.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Make RX SKB per-port\n\nThe SKB used to assemble packets from fragments in gmac_rx()\nis static local, but the Gemini has two ethernet ports, meaning\nthere can be races between the ports on a bad day if a device\nis using both.\n\nMake the RX SKB a per-port variable and carry it over between\ninvocations in the port struct instead.\n\nZero the pointer once we call napi_gro_frags(), on error (after\ncalling napi_free_frags()) or if the port is stopped.\n\nZero it in some place where not strictly necessary just to\nemphasize what is going on.\n\nThis was found by Sashiko during normal patch review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in the netdev RX path (gmac_irq \u2192 napi_schedule \u2192 gmac_napi_poll \u2192 gmac_rx) when Ethernet frames are DMA\u0027d from the wire, so any remote host that can send packets to a reachable Gemini GMAC interface can trigger it.\nAC:L - An attacker controls both sides of the race by flooding one or both GMAC ports with multi-descriptor/jumbo frames to keep skb assembly in progress while concurrent NAPI polls run on the independent per-port IRQ handlers without serialization on the shared static skb pointer.\nPR:N - Exploitation requires only the ability to deliver Ethernet frames to an active interface; there are no authentication gates, capability checks, or local syscalls on the RX path from hardware interrupt through gmac_rx().\nUI:N - Triggering the race requires only crafted or high-volume network traffic; no victim interaction such as mounting a filesystem or opening a file is needed.\nS:U - The corruption is confined to kernel networking state (shared skb assembly between the two GMAC ports on the same host); impact does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - Concurrent corruption of a shared skb and mismatched napi_get_frags/napi_gro_frags/napi_free_frags usage across ports can cause use-after-free and skb metadata corruption that enables arbitrary kernel memory disclosure.\nI:H - Cross-port skb corruption via concurrent skb_fill_page_desc and len updates, plus orphaned or double-freed skb/page state, provides memory corruption primitives that can be leveraged for arbitrary kernel writes or code execution.\nA:H - The race can cause kernel oopses or panics from slab/list corruption, invalid page refcount handling, or crashes inside napi_gro_frags when skb state is corrupted across the two ports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:45.763Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd62907f3cdbc3b6da8f49ba907c0390018fe5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d"
        }
      ],
      "title": "net: ethernet: cortina: Make RX SKB per-port",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64056",
    "datePublished": "2026-07-19T15:39:37.673Z",
    "dateReserved": "2026-07-19T07:54:57.030Z",
    "dateUpdated": "2026-08-05T12:38:45.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64056",
      "date": "2026-08-10",
      "epss": "0.00552",
      "percentile": "0.43104"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64056\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:46.057\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ethernet: cortina: Make RX SKB per-port\\n\\nThe SKB used to assemble packets from fragments in gmac_rx()\\nis static local, but the Gemini has two ethernet ports, meaning\\nthere can be races between the ports on a bad day if a device\\nis using both.\\n\\nMake the RX SKB a per-port variable and carry it over between\\ninvocations in the port struct instead.\\n\\nZero the pointer once we call napi_gro_frags(), on error (after\\ncalling napi_free_frags()) or if the port is stopped.\\n\\nZero it in some place where not strictly necessary just to\\nemphasize what is going on.\\n\\nThis was found by Sashiko during normal patch review.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/cortina/gemini.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"27856d533eca3804008695f61c1e4d5ff984196b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"b6b22824b30e48ce1df3a2e80990f4b8505deb50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"6bba24e9ebe6f1c0b356cd471e36bdc7fa434897\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"3b249988d774dacf13b203817e971934a42243c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"72158ea185b27afae163949b0e86164cb6b64e55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"cfd62907f3cdbc3b6da8f49ba907c0390018fe5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"67a35e7da7ef9d2f000aa758552a128324c604a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88\",\"lessThan\":\"06937db21ee311ed07eba47954447245041a982d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/cortina/gemini.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.142\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfd62907f3cdbc3b6da8f49ba907c0390018fe5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:06:58+00:00",
      "cve": "CVE-2026-64056",
      "id": "CVE-2026-64056",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ethernet: cortina: Make RX SKB per-port",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64056.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-07-21T13:00:28Z",
      "cve": "CVE-2026-64056",
      "id": "CVE-2026-64056",
      "initial_release_date": "2026-07-21T13:00:28Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64056",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64056.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.